Request filtering by principal names

[meikestone]

Hello, is it possible to inspect the KRB ticket request and allow only configured ticket request? E.g.

• TGT and service tickets for only one principal or
• only for one service ...

Thanks in advance

[frozencemetery]

kdcproxy doesn't currently have this functionality. In theory we could add it - service names are readable from the requests - though it would significantly complicate the decoder.

Can you explain your use case a bit more? It's possible there may be another solution.

[meikestone]

We have a webservice in our dmz and the service needs access to a internal database. The access to the database is only possible via kerberos. So the server is "forced" to obtain the tgt and the service ticket from the kdc periodicly. We dont want that the service and other machines can request (over firewall) arbitrary tickets from the kdc directly. So the idea is to setup a proxy so tha we can control and restrict the requested tickets by a server/service/host from the dmz to the kdc.

[frozencemetery]

I see, thanks for clarifying.

[michael-o]

??? Since your service runs on a machine with a fixed IP address, limit that in your web server hosting the Python app. This is what I do. I really do not see why further coding is necesary here.

[meikestone]

I don't understand, how that can mitigate the problem? The client machine in the dmz has a tgt and can request arbitrary service tickets, no matter what ip address is limitied ... Do I miss something?

[alfonsrv]

Another use case would be denying external domain administrator authentication via the KDC proxy.